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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the department's Freedom of Information Act implementation. The 
report is based on interviews with employees and officials of relevant agencies and 
institutions, direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Carlton I. Mann 
Assistant Inspector General for Inspections 
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Executive Summary 

This report assesses Department of Homeland Security Privacy 
Office implementation of the Freedom of Information Act, a statute 
designed to grant access to federal records. The Privacy Office 
advises department components on policies related to the act, 
although most components process requests independently. 

We reviewed how the Privacy Office facilitates compliance with 
two 2009 executive branch memorandums. In January 2009, the 
President directed agencies to have a "presumption of openness" 
on Freedom of Information Act releases. The Attorney General 
supplemented this vision with March 2009 guidance. We 
interviewed managers in 11 components, analyzed data, and 
studied policy. Specifically, we sought to determine the 
effectiveness of the Privacy Office's work with other components 
to implement the law. 

We determined that the Privacy Office has made important 
progress in ensuring openness. Components appreciate the 
collaboration and responsiveness of the Freedom of Information 
Act staff in the Privacy Office. These efforts help the department 
implement a complicated statute. 

We also determined that the Office of the Secretary has had 
unprecedented involvement in the Freedom of Information Act 
process beginning in 2009. For several hundred requests deemed 
significant, components were required to provide for headquarters 
review all the material they intended to release. The department's 
review process created inefficiencies that hampered full 
implementation of the Freedom of Information Act. We evaluated 
a Freedom of Information Act release about the review process, 
and identified some redactions we believe may have been 
inappropriate. We are making six recommendations to expand the 
progress that the Privacy Office has made. Three of these 
recommendations focus on how the Chief Freedom of Information 
Act Officer can provide more recommendations to the Secretary on 
ways to improve the department's Freedom of Information Act 
program. 
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Background 



Department of Homeland Security (DHS) records are subject to 
release under the Freedom of Information Act (FOIA). 1 Enacted in 
1966 and amended several times, FOIA mandates that certain 
executive branch information be accessible to the public. The right 
to receive records subject to disclosure is enforceable through the 
judicial process. 

The Supreme Court has written that FOIA is a "structural necessity 
in a real democracy," because the law facilitates the citizenry's 
ability to learn about government activities. 2 Various departments' 
FOIA disclosures have exposed a range of improprieties and waste, 
including health care fraud, misuse of grant funds, and illegitimate 
law enforcement practices. 3 

FOIA creates a presumption of disclosure. Material must be 
disclosed unless it comes within one of nine exemptions or three 
exclusions, summarized in Appendix C, to address instances when 
the government' s need to protect information may outweigh the 
public's right to know. Nonetheless, the law does not require use 
of exemptions in all applicable situations. In 1965, a Senate 
committee declared that successful FOIA implementation relies on 
"a workable formula which encompasses, balances, and protects all 
interests, yet places emphasis on the fullest responsible 
disclosure." 4 As the Supreme Court has noted, FOIA exemptions 
"were only meant to permit the agency to withhold certain 
information, and were not meant to mandate nondisclosure." 5 

In general, the statute requires agencies to process a FOIA request 
within 20 business days. Agencies can contact requesters to 
clarify what is being requested, or to note that the scope of the 
request is so large as to require additional processing time. When 
the agency denies the request in full or in part, it must explain why, 
and inform the requester of the right to appeal. 

On January 21, 2009, President Obama issued a memorandum on 
FOIA implementation that emphasized historical principles of 



1 5 U.S.C. § 552(a). 

2 Nat' I Archives and Records Admin, v. Favish, 541 U.S. 157, 171 (2004). 

3 The Right to Know: Your Guide to Using and Defending Freedom of Information Law in the United 
States at 94-99 (Santa Barbara, CA: Praeger Press, 2009). 

4 S. Rep. No. 89-813 at 3 (1965). 

5 Chrysler Corp. v. Brown, 441 U.S. 281, 294 (1979). 

6 5 U.S.C. § 552(a)(6). 
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information disclosure. Agencies were directed to make all FOIA 
decisions under a "presumption in favor of disclosure." When in 
doubt, the President wrote, "openness prevails." 

On March 19, 2009, the Attorney General, who provides FOIA 
policy guidance to federal entities, directed that agencies should 
not withhold records simply because an exemption may apply. 
When records cannot be fully disclosed, agencies must consider 
whether partial disclosure is possible. He added that "unnecessary 
bureaucratic hurdles" should not exist in a FOIA program. The 
Attorney General also directed that agencies should expand use of 
the Internet to post some information before FOIA requests are 
submitted. Such proactive disclosure requirements were originally 
added to FOIA in the Electronic Freedom of Information Act 
Amendments of 1996. 

This report refers to the memorandums of the President and 
Attorney General as the 2009 executive branch guidance. These 
memorandums, attached in Appendix D, reiterated the long- 
standing FOIA principle that information should not be withheld to 
protect public officials from embarrassment, to avoid disclosure of 
errors, or "because of speculative or abstract fears." 

Most of the department's components process requests for their 
own records under the guidance of a FOIA officer, while DHS 
Privacy Office staff processes requests for the Privacy Office and 
eight headquarters offices. From the Privacy Office, the Chief 
FOIA Officer, who is also the department' s Chief Privacy Officer, 
supports component efforts, shares information, and monitors the 
DHS FOIA program. However, the Privacy Office does not 
control FOIA processing in other DHS components, and agency 
FOIA officers are not supervised by the Chief FOIA Officer. 

To process requests, FOIA officers work with program experts to 
determine whether responsive information exists, then consider the 
possible exemptions or exclusions that would allow the agency to 
withhold all or part of the information. Experts at the components 
have the best knowledge about what information is responsive and 
whether disclosure of certain information could have an 
operational impact. The Privacy Office offers advice to 
components on FOIA law and policy, but a component can process 



7 P.L. 104-231. 

8 Office of the Secretary, Citizenship and Immigration Services Ombudsman, Office of Counternarcotics 
Enforcement, Domestic Nuclear Detection Office, Office of the Executive Secretariat, Office of Health 
Affairs, Office of Legislative Affairs, and Office of Public Affairs. 
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many requests without the intervention of other parts of DHS. 
Cases also arise that require the input of multiple DHS 
components, or other federal entities, such as the Department of 
State or the Federal Bureau of Investigation. 

DHS has a substantial FOIA caseload. In fiscal year (FY) 2009, it 
received 103,093 FOIA requests, or 18% of the federal 
government's 557,825 total requests. The number of requests rose 
to 130,098 in FY 2010. United States Citizenship and Immigration 
Services (USCIS) accounted for 70% of the DHS FY 2010 total. 
This is because USCIS maintains Alien Files, which are frequently 
requested records relating to an individual's immigration status. 

In addition to the volume of requests, DHS faces a challenge 
because FOIA requests can be complex. The size of requested 
documents and the need to consult with other agencies means that 
some FOIA requests cannot be processed in a timely manner. This 
is not necessarily indicative of inefficient disclosure procedures. 
Even though DHS staff may work with requesters to limit the 
scope of some requests to decrease response time, delays beyond 
the statutory deadline will occur. For FY 2010, even releases 
defined as "simple" took an average of 62 days to process. 

In March 2009, the U.S. Government Accountability Office 
reported on the department's overall FOIA program. 9 The review 
focused on DHS components that had the most pending requests. 
The report noted that the department has taken important steps to 
reduce request backlogs, which are FOIA disclosures that have not 
been released in the allotted timeframe. The report made five 
recommendations, including improvements in the use of redaction 
software, expanded training, and backlog monitoring. 

Results of Review 

The Privacy Office FOIA Staff Work Well With DHS 
Components 

The Privacy Office Helps DHS Implement FOIA 

DHS components have a strong working relationship with the 
Privacy Office. Component FOIA officials we interviewed praised 
the Privacy Office's FOIA staff for their approachability and 
responsiveness to requests for assistance. The Privacy Office 



9 U.S. Government Accountability Office, Freedom of Information Act: DHS Has Taken Steps to Enhance 
Its Program, but Opportunities Exist to Improve Efficiency and Cost-Effectiveness, GAO-09-260. 
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administers biweekly DHS FOIA teleconferences, an initiative 
established in March 2009. These calls help with the sharing of 
ideas, high-profile requests, litigation, and hot topics. 

Components report FOIA request processing statistics to the 
Privacy Office monthly, and the Privacy Office compiles data from 
the reports for the department's internal monthly report. The 
monthly component reports include the number of requests 
received and processed, the age of requests, and the number of 
times a component made a discretionary release and proactive 
disclosure. DHS set a department-wide 15% backlog reduction 
goal for FY 2010, which is above the 10% reduction goal that the 
Office of Management and Budget established in December 2009. 
Each month the Privacy Office calculates components' backlog 
reduction goal, establishing the number of processed requests that 
are needed to reduce any existing backlog. 

The Privacy Office conducts FOIA training for components. 
Training can cover FOIA in general or be tailored to specific 
situations, such as the use of particular exemptions. This training 
is based on a component's request, rather than a set schedule. 
When the President and Attorney General issued FOIA 
memorandums in 2009, the Privacy Office forwarded copies to 
DHS FOIA officials. Training slides and guidance that the 
Department of Justice (DOJ) prepared were also sent, as well as 
additional Privacy Office guidance on implementation of both 
memoranda. 

The Privacy Office has advocated for components that seek 
managerial support to hire more FOIA staff or to change FOIA 
operations. Interviewees stated that the Privacy Office 
successfully advocated for additional FOIA staff in two 
components and consolidation of one component' s multiple FOIA 
offices. A Privacy Office manager also participated in component 
FOIA officer hiring panels. The Privacy Office will lend its own 
staff to components that need processing assistance. One 
component's FOIA Officer is actually a Privacy Office employee. 

Progress Has Been Made on Proactive Disclosure 

In March 2009, the Chief FOIA Officer issued guidance to 
components on the new standard under FOIA. In addition to 
attaching a copy of the Attorney General's memorandum, the 
Chief FOIA Officer noted that all DHS employees share the 
responsibility to ensure transparency and administer FOIA 



The DHS Privacy Office Implementation of the Freedom of Information Act 

Page 5 



effectively, including an expansion of proactive disclosure through 
the use of electronic reading rooms available on components' 
public websites. The following categories of records are subject to 
proactive disclosure: 

1. Final opinions and orders made in the adjudication of 

cases; 

2. Policy statements adopted by the agency; 

3. Administrative staff manuals and instructions to staff that 
affect a member of the public; and 

4. Records released in response to a FOIA request that "are 
likely to become the subject of subsequent requests for 
substantially the same records." 10 

In May 2009, the Chief FOIA Officer took steps to expand 
proactive disclosure under FOIA by issuing another memorandum 
to senior DHS officials. That memorandum emphasized the 
presumption of disclosure and the need for discretionary release of 
information. The memorandum emphasized the historical view 
that exemptions do not apply merely because full or partial 
disclosure may cause embarrassment or demonstrate an error or 
failure. Distributing this information demonstrated a respect for 
the 2009 executive branch guidance and a desire to assist DHS 
components. 

FOIA managers informed us that DHS was the first department to 
issue its own proactive disclosure memorandum. This August 
2009 guidance from the Privacy Office directed components to 
disclose six categories of records, which expanded on the four 
types of information listed in FOIA section (a)(2). The following 
DHS records are subject to this disclosure: 

1. Historical daily schedules of the most senior agency 
officials; 

2. Executed contracts and grants; 

3. Management directives and instructions; 

4. Congressional correspondence; 

5. FOIA logs (summaries of cases so the public may 
understand what is being requested under FOIA); and 

6. Records released pursuant to a FOIA request that have 
been, or are likely to become, the subject of three or more 
requests. 



5 U.S.C. § 552(a)(2). 
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The Chief FOIA Officer provided additional assistance in October 
2009, by issuing guidance on formatting the senior officials' 
historical schedules prior to disclosure. Although the Privacy 
Office recommended that the department post calendars of officials 
at the Assistant Secretary (or equivalent) level or higher, 
components retained the ability to choose which officials' 
calendars they would disclose. The memorandum recommended 
that components use a public version of the calendar with the 
removal of information exempt from FOIA, such as personal 
appointments. The memorandum also included suggestions for 
describing events uniformly, such as when officials were on leave. 

In March 2010, the Chief FOIA Officer issued a memorandum to 
component heads reiterating the presumption of disclosure and the 
proactive disclosure categories. The memorandum included 
statistics showing that the department had increased the number of 
records released in full by 46% and the number released in part by 
73%. 

The DHS website provides a direct link to each major component's 
electronic reading room. Component FOIA officers appreciated 
the Privacy Office's efforts to expand the use of electronic reading 
rooms, but noted that challenges can inhibit this work. These 
challenges include an unexpected influx of FOIA requests, staffing 
limitations, and the time required to review documents. It can be 
time-consuming for busy component FOIA offices to redact 
calendars, contracts, and other documents subject to the DHS 
proactive disclosure policy. 

The DHS electronic reading room provides a list of frequently 
requested information, then directs users to which component or 
directorate will handle requests to locate records. We reviewed 
component websites to discover the extent to which records are 
disclosed proactively. FOIA logs, for example, are easily 
accessible, although the time periods covered vary. The Privacy 
Office has FOIA logs posted from 2004 to 2010. With few 
exceptions, component FOIA logs are posted for FY 2009 and 
2010. 11 

The DHS electronic reading room posts schedules for Secretary 
Napolitano. As of March 201 1, Secretary Napolitano's calendars 
for January 2009 through July 2010 are posted. There is 
inconsistency across components regarding the proactive 



11 http://www.dhs.gov/xfoia/editorial 0424.shtm#6 . 



The DHS Privacy Office Implementation of the Freedom of Information Act 

Page 7 



disclosure of senior officials' schedules, with limited posting in 
some components, or even no posting in certain cases. We 
observed that some of the delay is due to the extensive redaction 
process necessary to clear privacy-related information, in addition 
to pending clearance by officials. 

The DHS website posts the top five categories of requests that the 
department receives, along with information on the components to 
which an individual can send a request. The top five requests of 
the department are for Alien Files, contracts, disaster relief 
information, grants, and information on No Fly lists and the 

12 

Traveler Redress Inquiry Program. 

Proactive disclosure of contracts creates challenges for 
components and the Privacy Office, mainly because of concerns 
about proprietary information. To speed the proactive disclosure 
of contracts, the Privacy Office suggests that components begin to 
identify proprietary information when the contract is signed. 
However, our interviews with FOIA officers and our observations 
validate that inconsistencies in proactive disclosure of contracts 
exist across the department. Several components noted that the 
length of some contracts makes this process even more difficult. 
This has diminished the department's ability to achieve the goals 
of proactive disclosure. DHS receives a substantial number of 
FOIA requests for contracts, so additional proactive disclosure 
could serve the public and reduce the number of FOIA requests 
overall. The Privacy Office has been engaged on this matter, but 
additional attention is desirable. 

Clarification of the Public Liaison's Role Would Be Beneficial 

In 2005, Executive Order 13392 established the position of FOIA 
Public Liaison in federal agencies. The Openness Promotes 
Effectiveness in our National (OPEN) Government Act of 2007 
formally codified this position as a way to assist requesters in 
FOIA disputes with agencies. The Public Liaison, who reports to 
the DHS Deputy Chief FOIA Officer, serves as a mediator 
between components and FOIA requesters, but the position does 
not have control over agency FOIA operations. While DHS has 
only one Public Liaison, some departments, such as the 
departments of Defense, Energy, and Interior, have multiple Public 
Liaisons. 



http://www.dhs.gov/xfoia/editorial 0579. shtm . 
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FOIA officers and external agencies we interviewed said the DHS 
Public Liaison has improved the department's disclosure process. 
Managers at the Office of Government Information Services 
(OGIS), a FOIA mediation office that is part of the National 
Archives and Records Administration, said that the DHS Public 
Liaison is one of the best in the government. The Public 
Liaison's responsibilities include interaction with outside entities 
to facilitate FOIA disclosures. OGIS has sought the Public 
Liaison's assistance in facilitating the resolution of various DHS 
FOIA cases. Examples of OGIS work with the Public Liaison 
included two USCIS FOIA requests that were initially delayed or 
denied. OGIS officials and DHS FOIA Officers said that the 
Public Liaison is effectively handling the statutory mediation role. 

Even with the positive view of the Public Liaison, some 
departmental confusion exists. Because the statute does not 
provide extensive guidance, the Public Liaison suggested further 
development of policy on the mediation process and interaction 
with components. Confusion in parts of DHS led to the creation of 
public liaison positions in some components, although the Privacy 
Office recognizes only one Public Liaison across all of DHS. 
Additionally, the Public Liaison's ability to make changes to the 
FOIA requester service centers in components is part of the 
original role for the position, but the Public Liaison has limited 
ability to fulfill that function. Although the Privacy Office has 
helped components on customer service issues, greater clarity 
concerning the Public Liaison's work would be beneficial, 
especially regarding how the position can be used to foster any 
needed change in components' practices. 

The Privacy Office Can Build on Existing Reviews of 
Component FOIA Operations 

The Privacy Office should institute an ongoing review process to 
ensure continuing improvement in component FOIA operations. 
These regular reviews would allow the Privacy Office to discover 
problems and ensure ongoing compliance with FOIA and DHS 
policies. A FOIA manager provided us with a component's release 
in which redactions, which were made with a magic marker, did 
not protect the information from disclosure. The component's 
FOIA Office did not have an opportunity to correct this error 
before disclosure of the information. A Privacy Office process of 



13 OGIS was created to review federal agencies' FOIA policies and procedures, to mediate disputes, and to 
generally act as a "bridge" between FOIA requesters and federal agencies. 5 U.S.C. § 552(h)(1). 
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regular component reviews may identify such incorrect or 
inefficient practices. 

The Privacy Office has conducted some ad hoc component 
reviews, which resulted in greater efficiency across DHS. For 
example, in September 2008, the Privacy Office reviewed a 
component after receiving complaints from requesters. 
Components may also request assistance for a particular need, such 
as staffing problems. 

In January 2008, Privacy Office managers visited components to 
examine files and discuss processing challenges. At one 
component, incomplete files and inadequate office equipment 
hindered efficient operations. Privacy Office FOIA staff became 
involved in processing that component's FOIA requests as a result 
of this component visit. In another case, the Privacy Office 
reviewed FOIA operations at the three components with the most 
backlogs. Work with component staff helped identify and 
eliminate problems with backlog reduction. These reviews 
resulted in action to improve operations, such as hiring contractors, 
centralizing FOIA operations, and hiring a new FOIA officer. 

The Chief FOIA Officer suggested that any review process must be 
collaborative, because component FOIA officers would likely 
reject a mini-audit as too burdensome — a reasonable concern. We 
suggest that components have a role in how the review process 
would operate to ensure that unique statutory issues, such as Office 
of Inspector General (OIG) independence or other component- 
specific needs, are fully recognized. Instituting a regular review 
process should not damage the positive relationship between the 
Privacy Office and components. 

One interviewee suggested that the Privacy Office could institute 
regular reviews of component FOIA operations via a memorandum 
from the Chief FOIA Officer. This would be consistent with the 
Chief FOIA Officer's statutory authority under FOIA subsections 
(k)(l) and (k)(2) to have agency-wide responsibility for efficient 
and appropriate program compliance and to monitor 
implementation of FOIA across the department. Additionally, the 
newly created Deputy Chief FOIA Officer's position description 
includes a requirement to develop component reviews and 
inspections to ensure uniformity and maximum compliance with 
FOIA. The Privacy Office could further leverage its good working 
relationship with components through collaborative development 
of a protocol to review component FOIA operations. 
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Recommendations 



We recommend that the Chief FOIA Officer: 

Recommendation #1 : Develop additional internal policies 
regarding proactive disclosure to ensure consistency across 
components and quicker posting of information. 

Recommendation #2 : Formalize the roles and responsibilities of 
the Public Liaison. 

Recommendation #3 : Implement an internal review function to 
assess department- wide FOIA operations on a regular basis to 
maximize efficiencies and improve the administration of the 
department's FOIA operations. 

The Chief FOIA Officer Should Make Regular Use of the 
Statutory Authority to Advise the Secretary on Program Needs 

During our review, we learned that the Office of the Secretary was 
involved in examining certain FOIA releases prior to disclosure. 
This process was created so the department would be aware of 
certain FOIA requests deemed significant. After reviewing 
information and interviewing DHS FOIA experts, we determined 
that the significant request review process (hereafter, the review 
process) did not prohibit the eventual release of information. 
However, the intervention of the Office of the Secretary created 
inefficiencies. Although the review process delayed some releases, 
the Office of the Secretary is responsible to oversee DHS 
operations. The statute establishes that the Secretary "is the head 
of the Department and shall have direction, authority, and control 
over it." 14 Our concern pertains to the scope of and inefficiency 
caused by the review process, not to the Secretary's role, as head 
of DHS, in overseeing the FOIA performance of her subordinates. 
Although the department redesigned the review process in July 
2010, further enhancements can be made to improve FOIA 
implementation. To that end, the Chief FOIA Officer should use 
the authority at 5 U.S.C. § 552(k)(3) to make recommendations to 
the Secretary regarding ways to improve the DHS FOIA enterprise. 



6 U.S.C. §102. 
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The OPEN Government Act Established That Chief FOIA 
Officers Should Make Recommendations to the Secretary 

Congress made various changes to FOIA in the OPEN 
Government Act of 2007. For example, agencies must create 
individual tracking numbers for requests as a way to improve 
service provided to FOIA requesters. In addition, public disclosure 
of various data, such as processing times and use of exemptions, is 
required. 

The OPEN Government Act also created the position of Chief 
FOIA Officer in federal agencies. The Secretary appoints this 
individual, who serves at the Assistant Secretary level. The Chief 
FOIA Officer has agency-wide responsibility for efficient and 
appropriate compliance with FOIA. To coincide with this 
responsibility, 5 U.S.C. § 552(k)(3) establishes that the Chief 
FOIA Officer shall make recommendations to the Secretary for 
such adjustments to agency practices, policies, personnel, and 
funding as may be necessary to improve implementation of FOIA. 
The Attorney General reiterated this requirement in his March 
2009 memo. The Attorney General noted that Chief FOIA 
Officers must recommend such adjustments to agency practices, 
personnel, and funding as may be necessary. 

Components have noted several improvements across the DHS 
FOIA program since the Chief FOIA Officer' s arrival in March 
2009. 

The Office of the Secretary's Review of Significant Requests 
Was a Missed Opportunity for the Chief FOIA Officer To Use 
the (k)(3) Authority 

The Office of the Secretary's review of certain significant FOIA 
requests was the subject of a July 2010 Associated Press (AP) 
story, which led to concerns that the department was creating a 
"political filter" to slow the disclosure of DHS records under 
FOIA. 1 We were not able to substantiate the most serious 
allegations made in the AP story or subsequent public comments. 
However, we determined that the review process led to 
inefficiencies and slower processing of certain FOIA requests. 

We could not determine the exact number of FOIA requests that 
were subject to the review process because the cases were not 



"A Political Filter for Info Requests," Associated Press, July 21, 2010. 
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tracked consistently. We asked the Chief FOIA Officer for data on 
the time required to review significant cases. The information had 
to be collected manually, which took a considerable amount of 
time. The Chief FOIA Officer suggested that the data were not 
fully reliable. Even with these limitations, the data and DHS FOIA 
experts suggested that as many as 610 FOIA releases were 
identified as being significant, and thus subject to the review 
process, between late September 2009 and early July 2010. The 
data and DHS FOIA experts indicate that 150 to 250 FOIA 
responses were processed and thus part of the review process 
during this period. We were unable to resolve this discrepancy 
based on the incomplete data, and we do not estimate the exact 
number of requests involved. DHS received about 8,500 requests a 
month during the time the review process was formulated. 

The review process was initiated formally in September 2009, even 
though the Office of the Secretary pursued details about certain 
requests earlier. The review process was automated in July 2010. 
Components now place significant releases in SharePoint, a 
software platform that allows individuals to review and collaborate 
on documents. This enables interested personnel to review the 
content of releases to prepare for possible media coverage. After 
the information has been on SharePoint for 3 days, components 
may release it to the requester without a formal review process. 
We were informed in March 201 1 that the SharePoint process will 
be reduced to a 1-day hold. This change will further improve the 
DHS FOIA program. 

Advising the Office of the Secretary of Certain FOIA Requests 
Has Occurred in DHS for Several Years 

We received information from the Office of the Secretary and the 
Chief FOIA Officer about the origin of the review process. 
Components have been required to notify the Office of the 
Secretary of certain FOIA cases since 2005. This policy was 
designed to provide data on FOIA requests in general, including 
the identity of some requesters. Information gained is included in 
the department's weekly report to the White House. 

In 2006, the policy was revised to provide more guidance to DHS 
components on which types of FOIA requests were of interest for 
weekly reporting purposes. This policy did not require that the 
Office of the Secretary review the actual FOIA releases. Rather, 
the process provided information about what was being disclosed. 
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Among other areas, the Office of the Secretary asked for details on 
FOIA releases that — 

1 . Related to a presidential or agency priority; 

2. Would likely garner media attention; 

3. Contained documents related to meetings with prominent 
elected, business, or community leaders; or 

4. Were from the media, Congress, or special interest groups. 

This request policy remained in effect after the change of 
administrations. In 2009, the Office of the Secretary had a 
heightened interest in several specific FOIA requests. This 
prompted inquiries to components for more details about the scope 
of some requests and the individuals who had submitted them. A 
significant change occurred in September 2009, when components 
were prohibited from releasing responses to FOIA requests that 
met the criteria for inclusion in the weekly report until the Office 
of the Secretary reviewed the material. The inefficiencies we 
discovered began after the decision to review all significant 
requests prior to release. 

FOIA Disclosures Were Still Made Under the Significant 
Request Review Process 

We received information from FOIA experts at various DHS 
components and reviewed documents and communications related 
to the review process. None of this information demonstrated that 
the Office of the Secretary prohibited the eventual release of 
information under FOIA. Information we obtained from the FOIA 
staff and our review of documents corroborates this assessment. 

The Office of the Secretary Was Interested in Certain 
Requesters' Backgrounds Before the Significant Request 
Review Process Began 

In May 2009, staff in the Office of the Secretary asked questions 
about FOIA releases related to the department' s work on right- 
wing extremist groups. A report on the subject was researched 
during the Bush administration, but not finalized and released until 
after President Obama's election. DHS received several FOIA 
requests after initial media stories about DHS' analysis of right- 
wing extremism. A staff person in the Office of the Secretary 
asked the Privacy Office why certain FOIA requesters received 
expedited processing, a process the FOIA statute provides for 
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when a requester demonstrates a "compelling need." The next 
day, the Office of the Secretary asked, "Have we actually turned 
over any documents at this point? If so, when and what, and if not, 
when do we expect to?" One week later, the Office of the 
Secretary asked for a list of all 33 organizations that requested the 
right-wing extremism report. After the list was provided, a further 
inquiry was made regarding how many of the organizations were 
media outlets. 

Although internal discussions regarding agency actions are 
appropriate, in this context, these discussions created "unnecessary 
bureaucratic hurdles" that delayed DHS components' ability to 
respond more timely to FOIA requests. For example, why a 
specific document was requested is insignificant under FOIA, 
since requesters do not need to justify their interest in desired 

17 

records. The Supreme Court has established that : 



"citizens should not be required to explain why they seek the 
information. A person requesting the information needs no 
preconceived idea of the uses the data might serve. The information 
belongs to citizens to do with as they choose . . . the disclosure does 
not depend on the identity of the requester. As a general rule, if the 
information is subject to disclosure, it belongs to all." 



Department officials told us that that advance knowledge of 
significant releases can improve the DHS response to the media 
inquiries that often follow public release of information about DHS 
activities. While the department has a legitimate obligation to 
respond to media inquiries, we are not persuaded that delaying a 
FOIA release so that officials can prepare for expected inquiries is 
the best public policy. Again, the problem is that some of these 
inquiries delayed the final issuance of some FOIA responses. 

The department did not violate privacy laws or other rules when 
the Office of the Secretary gained information about some 
requesters. Indeed, agencies usually disclose the identities of 
requesters to the public when posting FOIA logs. 



5 U.S.C. § 552(a)(6)(E). DHS regulations set forth standards for evaluating such requests. 6 C.F.R. 
§ 5.5(d). 

National Archives and Records Administration v. Favish, 541 U.S. 157, 172 (2004). 
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Examples Exist of Statutory Noncompliance and Inefficiencies 
Caused When Some Significant Requests Were Reviewed 

Documents we received demonstrate several cases of releases 
being delayed because the Office of the Secretary asked basic 
questions about the FOIA process or for other minor reasons. In 
many cases, delays under the review process were short. Some 
releases needed only 1 to 4 days for completion of the review 
process. These relatively brief delays still caused the temporary 
withholding of certain documents that a component was prepared 
to release. 

Other releases were delayed longer. In one example, the Office of 
the Secretary received a component's release on October 16, 2009. 
The review was delayed at least 10 calendar days because of 
higher-priority business in the reviewing office. We are not 
including quotations from this and several other e-mails related to 
the review process because the statements were redacted in 
information released to AP. We will discuss the redactions from 
the release to AP later in this report. 

A similar example occurred on November 9, 2009, when the 
Privacy Office forwarded a FOIA response to the reviewers in the 
Office of the Secretary. Three days later, a staff person replied, "I 
have a few questions about this one." On November 17, the 
Privacy Office asked about the status of the request, since no 
authorization had been received to permit release of the 
information. Data we received from the Privacy Office included a 
range of examples of cases that were under review at the Office of 
the Secretary for several weeks. 

We cannot establish how often the review process caused the delay 
of FOIA releases to the point of statutory violation (i.e., delays that 
extended the response time beyond the 20-business-day statutory 
deadline). Office of the Secretary personnel said that significant 
releases were not simply stuck in the process waiting for a staff 
person to review the information. Some proposed releases may 
have been returned to the component with a question, or sent to the 
Office of the General Counsel for further legal review or to check 
the consistency of redactions. Regardless of how the release was 
handled while in the review process, data suggest, but we cannot 
confirm with exactness, that dozens of FOIA releases were delayed 
for weeks while the component waited for approval to disclose the 
information to the requester. Many of these requests appeared to 
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have been in process for more than 20 business days and thus had 
already exceeded the statutory deadline before the review process 
began. The delay of even one FOIA request beyond the statutory 
deadline creates legal risk, because a requester can file in U.S. 
district court for judicial review as soon as the statutory time 
period for responding passes. 

Again, in certain cases, review process delays led to violations of 
the statutory deadline. For example, a component received a FOIA 
request on March 1, 2010, and completed processing it on March 
19. The release could have been made then, which was within the 
20 business days required in the statute. However, it was not until 
March 31 — 23 business days after the request was made — that an 
Office of the Secretary staff person submitted minor edits to clarify 
the component's response. The original language and suggested 
edits appear below: 

Original wording in the component's response letter 



In responding to a FOIA request, the DHS/Privacy Office will 
search for responsive documents in its control on the date the 
search began. We began our search on March 4, 2010. 



Wording changes that the Office of the Secretary suggested 



Beginning on March 4, 2010, the DHS/Privacy Office searched 
for responsive documents in its control on the date the search 
began. 



The department officials told us that correcting errors in cover 
letters was necessary, and led component authors to devote more 
attention to grammar and quality. Letters with errors reflected 
poorly on the department's professionalism and service, they 
added. We agree that certain letters could be improved. The 
department may wish to remain focused on the quality of FOIA 
response letters, and the component review process we recommend 
should facilitate needed improvements without a delay in 
disclosing information. We do not support delaying FOIA requests 
beyond the statutory timeframe to make minor edits, which is 
inconsistent with the purpose of FOIA and the short timeframes 
established in the statute. 

Other cases of delay are evident. In a June 2010 case, a 
component asked for an update more than 3 weeks after the review 
process began. In reply, a Privacy Office manager said that the 



The DHS Privacy Office Implementation of the Freedom of Information Act 

Page 17 



release was still in the review process. The component FOIA 
expert noted the urgency of the matter, since the review process 
caused a violation of the 20-business-day response requirement. 

Even when the review process did not violate the statutory 
timeframe, inefficiencies resulted. On several occasions, staff in 
the Office of the Secretary made basic inquiries about FOIA in 
general and why records were being sought in particular cases. In 
most instances, neither FOIA officers nor program experts would 
have answers to such questions. To the extent the staff was 
seeking answers to specific operational questions raised by FOIA 
requesters, the staff should direct such questions to program 
experts, not FOIA processors. Additionally, FOIA does not 
require requesters to specify why they want records. Nonetheless, 
the Privacy Office provided e-mail responses to such questions in 
some cases. Reviewed materials reflected the frustration of FOIA 
staff throughout the department regarding the time required to 
respond to such inquiries. 

Inefficiencies were also created when responsive documents were 
too large to send via e-mail. In certain instances, Privacy Office 
managers had to hand-carry paper or disk copies of FOIA releases 
to the Office of the Secretary. These actions did not result in major 
expenses or extensive processing delays, but the inefficiency 
involved is at odds with the 2009 Attorney General memorandum, 
which began by emphasizing "our nation's fundamental 
commitment to open government" through implementation of the 
President's vision. The memorandum also articulated a view that 
"timely disclosure of information is an essential component of 
transparency." The practices outlined above were contrary to this 
spirit. 

When we interviewed the Chief FOIA Officer and a staff person in 
the Office of the Secretary, they agreed that the review process 
introduced some delays and inefficiencies. Both told us that only a 
few cases were affected in any significant way. We were provided 
examples where the Office of the Secretary worked with 
component counsel to improve FOIA responses. In one case, the 
Office of the Secretary ensured that a component did not 
prematurely release another department's records. 

The department also informed us that the leadership of the Privacy 
Office and officials in the Office of the Secretary helped to 
develop the SharePoint process now used, which facilitates release 
of information while still providing managers with the awareness 
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they need about cases that will likely cause media interest. We 
acknowledge that the use of SharePoint is preferable to the 
abandoned process that delayed dozens of releases for long 
periods. However, the new process is not required by FOIA and 
seems inconsistent with the 2009 FOIA guidance prohibition of 
"unnecessary bureaucratic hurdles." The department should 
continually examine how any delay affects statutory compliance 
and the efficiency of the DHS disclosure program. We do not 
understand why certain finalized releases, even for "awareness" 
purposes, must remain in the department's control for 3 days, 
effectively trimming to 17 days the amount of time available to 
FOIA processing officers if the entire process is still to satisfy the 
20-day statutory limitation. 

DHS FOIA Experts Questioned the Utility of the Significant 
Request Reviews 

We interviewed FOIA experts in the Privacy Office and 10 other 
DHS components, including those in the Office of Inspector 
General. These offices received 99% of DHS FOIA requests from 
October 2008 through June 2010. Generally, the experts had a 
negative view of the significant review process. 

When the Office of the Secretary began to request copies of all 
significant FOIA disclosures prior to release, the Chief FOIA 
Officer expressed concern to a senior official in the Office of the 
Secretary. Under the process, components would send certain 
FOIA releases to the Privacy Office. Staff there would forward the 
information to the Office of the Secretary for review. The Chief 
FOIA Officer suggested that the process could create inefficiencies 
and burden the components. Although the Office of the Secretary 
later improved the process through SharePoint, the concerns that 
the Chief FOIA Officer expressed as the review process was being 
established were not heeded. 

Documents we reviewed indicate that the Chief FOIA Officer' s 
reservations continued after implementation of the review process. 
In December 2009 e-mail messages to her staff, the Chief FOIA 
Officer lamented the level of attention that the Office of the 
Secretary was giving to significant requests. In that same month, 
the Chief FOIA Officer informed the DHS Office of the General 
Counsel that staff involved in the review process had suggested 
inappropriate edits to FOIA release cover letters — edits that would 
have altered the information requesters received on appeal rights 
when FOIA denials were made. 
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Through internal communications, Privacy Office managers shared 
process concerns on several occasions. In a February 2010 
memorandum, one manager wrote that review of requests in the 
Office of the Secretary is "a significant resource drain" for 
components, prompting delays in FOIA releases and loss of 
efficiency. These concerns were reiterated in April 2010: "The 
front office review process has significantly hampered the ability 
of DHS and its components to respond promptly to requests." 

Other components did not experience notable delays or were less 
opposed to the review process. These FOIA officers said the 
review was designed to improve DHS awareness of major public 
requests, and added that records were released after review from 
the Office of the Secretary, although some cases were not released 
in a timely manner. No FOIA officer said that requesters were 
disadvantaged because of their political party or particular area of 
interest. Nonetheless, some FOIA officers who were less critical 
of the process expressed doubts about significant review, with one 
suggesting that the Office of the Secretary likely had more 
important work to do than review FOIA disclosures prior to 
release. 

Data From One Component Demonstrate That the Significant 
Request Review Process Added to FOIA Processing Times 

Components rarely tracked the time requests spent in the review 
process. The incomplete data we were provided support what 
component FOIA officers have suggested: There was wide 
variation in the time required to complete the review process. Staff 
in the Office of the Secretary assigned to review significant FOIA 
releases were responsible for various other tasks, which likely 
explains the inconsistent response time to FOIA cases. Also, some 
delays developed outside the Office of Secretary, as the Secretary's 
Office forwarded certain requests to the Office of the General 
Counsel for additional review. 

For a short period, one component tracked the amount of time 
involved in the Office of the Secretary review of significant FOIA 
requests. Of the 53 cases monitored, which covered releases sent 
for review from March through July 2010, it took the Office of the 
Secretary an average of 15 business days to complete the review 
process. The component could not send the information to the 
requester until this review was completed. However, several cases 
among the 53 cases monitored were part of the review process for 
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far longer than the 15-day average. Of the 20 significant releases 
sent in March and April, three took more than 40 business days, 
with one case taking 46 days. Six other cases were in the review 
process between 30 and 40 days. Of the 53 cases, 15 spent more 
than 20 business days in the review process. 

In our interviews, several DHS FOIA managers stressed that the 
process was counter to the statute and the 2009 executive branch 
guidance. Different component experts declared that the process 
was "a disservice to the requester" that had "no added value" to 
DHS FOIA practices. 

FOIA officers can be concerned with delays even when only one 
case is affected, because of potential legal liability and the desire to 
serve requesters promptly. This was the view of components that 
had few significant requests during the process. One of these 
component's FOIA officers said that the review process took more 
than 90 days in one case. 

The Significant Request Review Process Led to Negative Media 
Attention 

Even if the process had improved the department's FOIA 
processing, the delays it caused, the July 2010 AP story, and the 
subsequent congressional scrutiny led to negative comments from 
the press and those interested in more disclosure under FOIA. The 
effort to improve "awareness" of significant requests actually 
increased negative attention from the media. 

We found several examples of media negativity. The review 
process also prompted a request to Inspectors General from 
Representative Issa and Senator Grassley to evaluate political 

1 8 

appointees' control over FOIA. 

Additionally, an Internet blog associated with a newspaper 
declared that the review process meant the new administration was 
"no friend of FOIA," while an Arizona Daily Star editorial stated 
that DHS actions were contrary to the "bedrock" of public 
information laws. Another editorial noted that the DHS policy was 
at odds with open government principles. 19 



"House panel expands probe of information requests," Washington Post (February 1, 201 1), 
http://grassley. senate. gov/news/Article.cfm?customel_dataPageID_1502=28447. 
19 "Obama administration no friend of FOIA," Missoula Editor (July 22, 2010), 

http://missoulaeditor.com/?p=1799 ; Editorial, "Freedom of Information is a Public Right," The Arizona 
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Some websites were more negative, even to the point of being 
inaccurate. One used animation to show the Secretary placing 

20 

some FOIA requests in the trash. As we have noted, the review 
process did not lead to the denial of eventual information 
disclosure. 

Sufficient Concern Existed for the Chief FOIA Officer To 
Recommend That the Secretary End the Review Process 

The information we received demonstrates that the review process 
created inefficiencies in the FOIA process. Such inefficient 
oversight of significant requests before release led to statutory 
noncompliance or prolonged delays in some cases. Additionally, 
various individuals who reviewed significant cases, including 
senior DHS officials, had little to contribute to the department's 
disclosure program. As cases went unprocessed for weeks, the 
Chief FOIA Officer could have invoked 5 U.S.C. § 552(k)(3). 
Recommending changes to DHS FOIA practices would have 
informed the Secretary of problems related to the review process. 

The Chief FOIA Officer has improved the FOIA process at DHS. 
Components believe the Chief FOIA Officer deserves credit for the 
positive communication and open dialogue across the department's 
FOIA offices. Components also believe that the Chief FOIA 
Officer's staff deserves praise for their roles in improving DHS' 
FOIA operations. To further improve the DHS FOIA program, the 
Chief FOIA Officer should develop a policy to use the (k)(3) 
authority on a regular basis. Doing so would give the Secretary 
information on what is needed to improve DHS FOIA operations. 
This is important because of the legal risks that exist under the 
statute, and because the President has declared that FOIA is "the 
most prominent expression of a profound national commitment to 
ensuring an open Government." To support this determination, the 
Attorney General noted, "Timely disclosure of information is an 
essential element of transparency." 

Based on information we received, the review process is still being 
used. Inefficiencies and time lags may therefore still exist when a 
FOIA request falls into that process. Further analysis by the 



Daily Star at Al 1 (July 23, 2010); "Political Scrutiny Tops at Homeland Security," Grand Junction Daily 

Sentinel, July 22, 2010. 

20 American Thinker (July 23, 2010), 

http://www.americanthinker.com/blog/2010/07/beware if you make an foia req.html . . 
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Privacy Office could lead to specific (k)(3) recommendations on 
the discontinuance of this process, or perhaps changes to the 3- or 
1-day hold on issuing the response pending that review. 

We requested all documents related to the Chief FOIA Officer's 
use of the (k)(3) authority. In addition to the DHS proactive 
disclosure memorandum, we received one July 2010 
memorandum, an analysis of the need for additional support to 
reduce the backlog in FOIA appeals. The Chief FOIA Officer said 
that an appeals backlog "presents a potential litigation risk and is 
not in keeping with the Administration's aspirations and directions 
regarding compliance with FOIA." This exact wording could have 
been used to recommend an end to the review process. 

Because the Chief FOIA Officer holds a vital position as advisor to 
the Secretary, routine use of (k)(3) reports would empower the 
Privacy Office and improve FOIA compliance across DHS. 
Recommendations under (k)(3) should be used to implement the 
President's vision and reduce the department's exposure to legal 
risk. Because the need for recommendations may fluctuate over 
time, a determination on the frequency of reporting should be at 
the discretion of the Chief FOIA Officer. 

Recommendation 

We recommend that the Chief FOIA Officer: 

Recommendation #4 : Report as necessary to the Secretary, based 
on 5 U.S.C. § 552(k)(3), to recommend improvements to the DHS 
FOIA enterprise. 

Additional Guidance Is Needed on How DHS Will Make 
Discretionary Releases Under FOIA 

Some Office of the Secretary Personnel Misunderstood FOIA 
and the 2009 Executive Branch Guidance 

Even though the Office of the Secretary did not deny FOIA 
requests, legitimate concern exists when any process decreases the 
efficiency of FOIA processing. Such problems can lead to 
statutory noncompliance and a disregard of presidential directives. 
Based on the e-mail messages exchanged between the Privacy 
Office and the Office of the Secretary, we determined that some 
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staff in the Office of the Secretary involved in the review of 
significant requests did not have sufficient knowledge of FOIA. 

One case involved an individual's interpretation of the Privacy 
Office's August 2009 proactive disclosure memorandum. As 
noted previously, the memorandum was a positive step to expand 
the statutory requirement to make more documents available in 
DHS electronic reading rooms. Interpretations of this 
memorandum by personnel in the Office of the Secretary in one 
case detailed below were at odds with the OIG's view of statutory 
intent and the 2009 executive branch guidance. [Exact quotation 
withheld.] 

This individual implied that the potential embarrassment of DHS 
should be considered when making proactive disclosure decisions. 
The expectation of greater disclosure is clear in the 2009 executive 
branch guidance, even though it is true that the President's 
memorandum did not create new rights for persons or prevent the 
government from asserting necessary exemptions. FOIA is 
indisputably a disclosure statute, not a means for federal agencies 
to keep embarrassing information from the public. 

In another case, the statements of a senior official in the Office of 
the Secretary implied an effort to decrease the level of FOIA 
disclosure. In March 2009, 6 months before the review process 
began, the official suggested, "Nothing should be released" in a 
specific request for pre-decisional documents. In another instance, 
it was suggested that the department should send public 
information only to a particular requester. Government employees 
should undoubtedly ask questions and offer suggestions while a 
course of action is under consideration. This is the "deliberative 
process" in which government employees must engage in order to 
make reasoned decisions. Thus, the fact that these suggestions 
were not adopted as policy is significant. However, a FOIA 
manager expressed concern that the official's suggestion could 
have led a component to limit the search for department records 
because the focus of the analysis was on withholding versus 
disclosing records. 

Other individuals in the Office of the Secretary had an incorrect 
view of what FOIA required. In the case of a right-wing 
extremism FOIA request, the DHS Office of Intelligence and 
Analysis did not redact the draft mission statement for the former 
Extremism and Radicalization Branch of the Homeland 
Environment Threat Analysis Division. The inclusion of this 
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information in the component's proposed release raised concern on 
the part of a staffer reviewing the significant release. 

This instance demonstrated further misunderstanding of the FOIA 
process. Even though program experts and FOIA staff had already 
determined that the draft mission statement was responsive and 
that it should be released, there was a suggestion that the draft 
material should not become public simply because it was a draft 
document. The fact that a document is a draft is one factor in the 
deliberative process analysis, but not the only factor. Although we 
did not find evidence that the material was withheld, FOIA is a 
disclosure statute that requires release of information unless an 
exemption authorizes or requires the agency to withhold the 
records. Also, although agencies may make discretionary 
disclosures of records that fall under certain exemptions, changes 
in administrations over the years have resulted in varied 
applications of this authority. The 2009 executive branch FOIA 
guidance established that agencies should not withhold records 
simply because an exemption may apply, as FOIA decisions are to 
be made under a "presumption in favor of disclosure." Thus, a 
suggestion to reevaluate a FOIA release in order to find a basis for 
withholding when the release had already been determined to be 
required under FOIA, does not appear to be consistent with these 
guidelines. Again, government employees should freely question 
proposed decisions as part of the deliberative process. However, 
doing so without a clear understanding of FOIA adds little to the 
agency's decision-making process and delays the FOIA response. 

Additional Information May Have Been Appropriate for 
Release to the AP Regarding the Significant Request Review 
Process 

In January 2010, the AP submitted a FOIA request for information 
about the department's FOIA review process. We examined the 
FOIA release to gain an understanding of how exemptions were 
applied. While the bulk of the redactions undoubtedly were 
appropriate, we are concerned that certain statements may have 
been withheld from the AP release merely to avoid embarrassment 
to the department, which is not appropriate under FOIA, and 
certainly not under the 2009 executive branch guidance. The 
Privacy Office had minimal participation in the AP release, since 
most of the requested e-mails included Privacy Office staff. 
Instead, the DHS Office of the General Counsel made the 
redaction decisions. 
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The redactions we questioned were generally made under FOIA 
Exemption 5, which covers "memorandums or letters which would 
not be available by law to a party other than an agency in litigation 
with the agency." 21 The exemption protects information that is 

99 

normally privileged in civil discovery. Among other privileges, 
courts have determined that agencies can protect deliberative 
processes so as not to "stifle honest and frank communication 
within the agency" and to protect "the consultative functions of 
government." 23 Case law suggests that "advisory opinions, 
recommendations, and deliberations comprising part of a process 
by which governmental decisions and policies are formulated" can 
be protected. 24 Exemption 5 can protect agency discussions on pre- 
decisional matters so that employees can provide advice without 
concern for public disclosure. 

Even before the 2009 executive branch guidance, judicial decisions 
interpreting deliberative process under Exemption 5 required 
agencies to evaluate pre-decisional materials under various factors 
in order to determine whether the privilege applied. In 1975, a 
U.S. Appeals Court made points that remain valid. "[P]re- 
decisional materials are not exempt merely because they are pre- 
decisional," the court noted. "[T]hey must also be a part of the 
agency give-and-take of the deliberative process — by which the 

25 

decision itself is made." This means that Exemption 5 does not 
protect all pre-decisional agency documents, and specifically, that 
the pre-decisional nature of a document alone is not enough to 
justify withholding release under FOIA. 

This is especially important when considering the 2009 executive 
branch guidance. In the updated version of the Guide to the 
Freedom of Information Act, the Department of Justice wrote, "[I]t 
is important to first note that the President and Attorney General 
have issued memoranda to all agencies emphasizing that the FOIA 
reflects a 'profound national commitment to ensuring an open 
Government' and directing agencies to 'adopt a presumption in 

9fi 

favor of disclosure.'" 



21 5 U.S.C. § 552(b)(5). 

22 NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 149 (1975). 

23 Id. at 149; Coastal States Gas Corp. v. Dep't of Energy, 617 F.2d 854, 866 (D.C. Cir. 1980). 

24 In re Sealed Case, 121 F.3d 729, 737 (D.C. Cir. 1997). 

25 Vaughn v. Rosen, 523 F.2d 1136, 1144 (D.C. Cir. 1975). 

2 U.S. Department of Justice Guide to the Freedom of Information Act at 357 (Government Printing 
Office, 2009). 
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In addition to this general advice applicable to all FOIA releases, 
April 2009 DOJ guidance suggests that pre-decisional material is 
suitable for discretionary disclosure: 

There is no doubt that records protected by Exemption 5 hold 
the greatest promise for increased discretionary release under 
the Attorney General's Guidelines. Such releases will be 
fully consistent with the purpose of the FOIA to make 
available to the public records which reflect the operations 
and activities of the government. Records covered by the 
deliberative process privilege in particular have significant 
release potential. In addition to the age of the record and the 
sensitivity of its content, the nature of the decision at issue, 
the status of the decision, and the personnel involved, are all 
factors that should be analyzed in determining whether a 

27 

discretionary release is appropriate. 

Public data from the Privacy Office demonstrate that the 
department's use of Exemption 5 has grown considerably, even 
though total FOIA requests have declined. In 2006, the department 
received 137,871 requests, with 33,705 uses of Exemption 5. For 
2009, the comparable numbers were 103,093 and 59,510. Thus, 
while total FOIA requests decreased by 25%, the use of Exemption 
5 increased by 77%. In FY 2010, use of the exemption decreased, 
but remained high compared to historical standards. The 
department received 130,098 requests, and Exemption 5 was used 
in 41,828 instances. These numbers in isolation may not be cause 
for concern, especially since the types of records requested will 
largely determine whether Exemption 5 applies to particular 
records. Nevertheless, in the context of the Office of the 
Secretary's previous involvement in the FOIA process, the 
numbers help to suggest that additional clarification on the 
requirements of FOIA is justified. 

The DHS release of information to the AP provides examples in 
which we question whether DHS fully implemented the 
presidential vision for greater release of deliberative process 
material. We are not quoting from these materials because the 
material was redacted. Although there were some efforts to 
change FOIA responses, we could not substantiate that such 
changes were made before information was released. 
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Potentially embarrassing wording was redacted in other cases as 
well. In November 2009, a senior DHS official suggested 
limitations on the release of a particular request that a component 
was processing. Additional redactions were made in some 
instances where FOIA managers expressed frustration with the 
review process. The 2009 executive branch guidance could 
reasonably be interpreted to suggest release of these statements. 
These comments were made after the Office of the Secretary had 
already established the review process. Redaction of such 
statements was not based on an understanding that the purpose of 
the deliberative process privilege was to "prevent injury to the 
quality of agency decisions." 28 These post-decisional comments 
were not made in a deliberative context to those who could change 
the policy. Assuming these statements were responsive to the 
FOIA request, and no other exemption applied, we believe that 
release of the statements, rather than redaction, would have been 
more appropriate based on the 2009 executive branch guidance. 

Our conclusions about certain AP redactions reflect a difference of 
opinion with the department on a limited number of choices that 
were made with this FOIA release. Any statements we make about 
the AP release do not mean that we have concluded the department 
acted in an unlawful manner. Nor do we suggest that the use of 
Exemption 5 across DHS is incorrect or even that every use in the 
AP release is worrisome. The AP's FOIA request was not known 
to us during the planning phase for this inspection. The content of 
the release is directly relevant to the review process, which became 
a major focus of this report. Thus, a detailed review of that FOIA 
release and the hundreds of redactions made therein — in the 
context of evaluating the FOIA review process — was appropriate. 

To ensure the fullest possible respect for the 2009 executive branch 
guidance, the Chief FOIA Officer should recommend that the 
Secretary issue instructions on the use of redactions. This 
guidance should clarify that departmental interests under 
Exemption 5 must be balanced, and that Exemption 5 is not 
designed to shield embarrassing or controversial words from public 
scrutiny. Policy statements such as the 2009 executive branch 
guidance, in conjunction with established case law, must govern 
redaction decisions under FOIA. A policy statement from the 
Secretary would express the sentiment that DHS fully embraces 
the President's vision for FOIA releases. We have noted the 
positive work that the Privacy Office initiated after the 2009 
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executive branch guidance, and efforts to enlist the Secretary's 
support for additional transparency would promote the 
department' s adherence to the new FOIA paradigm. 

Recommendation 

We recommend that the Chief FOIA Officer: 

Recommendation #5: Use the authority at 5 U.S.C. § 552(k)(3) to 
recommend to the Secretary that the Secretary issue written 
guidance to the department on the President' s reiteration that 
embarrassment, abstract fears, and the exposure of failure are not 
grounds to exempt information under FOIA. 

Recommendations Under the (k)(3) Authority Are Necessary To 
Improve DHS FOIA Staffing 

Some FOIA officers we interviewed expressed concern about 
inadequate staffing. Even FOIA officers who believed that staffing 
was sufficient said problems would arise if FOIA requests 
increased. Several component FOIA officers said that progress 
with proactive disclosures has suffered because of the need to 
focus resources on incoming requests. Interviewees suggested that 
additional FOIA staff would allow for concentration on backlog 
reduction and more proactive disclosure. 

The Privacy Office has detailed staff to other components when 
staffing needs arose, but this is not a permanent solution to agency 
staffing concerns. Two interviewees suggested that the department 
could detail existing FOIA staff to other components that needed 
assistance. A short-term alternative to additional funding or 
detailees would be the formation of a task force or working group 
to address staffing needs and render assistance throughout the 
department on an as-needed basis. 

At 103,093 requests, DHS had the most FOIA requests in the 
federal government in FY 2009, the last year full data for the entire 
government are available. Managing the backlog for such a busy 
FOIA operation can be difficult. In January 2010, the 
department's backlog was 12,406 requests. The backlog increased 
to 17,319 requests in June 2010, a 39.6% increase in 6 months. 
The backlog by the end of FY 2010 fell to 1 1,383. 
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In March 2010, the White House issued a memorandum to agency 
and department heads requesting that they take certain steps to 
implement the President's 2009 FOIA guidance. One of those 
steps was to assess the level of resources for FOIA processing to 
ensure prompt responses and cooperation with requesters. We 
received data that substantiated the department's effort to hire 
additional FOIA staff. At the end of FY 2010, DHS had 420 full- 
time FOIA staff, an increase of 40 positions in 1 year. 
Nonetheless, nine DHS components reported an increase in their 
FOIA backlog during FY 2010. 

Even with the efforts to increase staff and reduce FOIA backlogs, 
the department's FOIA caseload can still be difficult to manage. In 
an April 2010 internal memorandum, the Director, Disclosure and 
FOIA, noted that other departments' staffing resources exceeded 
those of DHS. This prompted a recommendation that several 
components should have additional FOIA personnel. The 
department should ensure that the FOIA staffing issue remains a 
focused area of study, especially since backlog reductions fluctuate 
throughout the year. Staff may also be necessary to focus 
resources on proactive disclosure. 

Recommendation 

We recommend that the Chief FOIA Officer: 

Recommendation #6 : Study and make recommendations to the 
Secretary regarding FOIA staffing levels. 

Management Comments and OIG Analysis 

The Privacy Office and DHS Office of General Counsel submitted 
a consolidated response to our report. We have made changes to 
the report where we deemed appropriate. A copy of the 
department's response, in its entirety, is included as Appendix B. 
We also received technical comments from the department, and we 
have made corrections to the report based on these comments. 

The department concurred with each of our six recommendations. 
The formal response to our report included concerns about specific 
OIG methodologies and conclusions, as well as a management 
response to each recommendation. Our analysis of the DHS 
response to the recommendations follows a brief discussion of the 
department's concerns. 
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Our report fully respects the right of the Secretary to direct and 
control DHS. Positive change can result when the Office of the 
Secretary reviews and coordinates component activities. This has 
been particularly useful to our office when we issue reports that 
involve multiple parts of DHS. 

It is appropriate that the Secretary oversee the DHS FOIA 
program. It is also appropriate that there be internal debate among 
DHS employees about DHS programs, and FOIA processing is no 
exception. We simply determined that the unprecedented scope of 
the review process, and specifically the 2009 decision to hold 
releases to requests deemed significant until the review was 
completed, created various inefficiencies and delayed some 
releases. Because the department stopped most parts of the 
process after less than a year of operation, including a change as of 
March 28, 201 1, to reduce the 3-day hold to a 1-day hold, we 
conclude that the Office of the Secretary agrees that the review 
process was unworkable as formerly executed. 

We also fully respect the intent of FOIA Exemption 5. Case law 
and the 2009 executive branch guidance have established that a 
statement is not subject to protection under Exemption 5 simply 
because it is pre-decisional. Whether a redaction can or should be 
made are two different analytical questions. The President's 
January 2009 guidance on FOIA, and DOJ policies issued in 
response to it, are clear on this. Because the department concurs 
with each of our recommendations, we believe the difference of 
opinion is not as serious as one might infer from some parts of the 
management response. The OIG will continue to seek the most 
efficient and effective policies across DHS, and we are pleased that 
the department respects that role. 

Recommendation #1 ; That the Chief FOIA Officer develop 
additional internal policies regarding proactive disclosure to ensure 
consistency across components and quicker posting of information. 

Management Response: The department concurred with 
Recommendation #1. The Privacy Office noted the various 
enhancements the department has made in proactive disclosure. 
The department's electronic reading rooms include more than 
10,000 pages of documents, and new publications are released 
every week. Further work to address this important area, through 
collaboration with component FOIA officers, is ongoing. The 
Privacy Office anticipates that it will have a department- wide 
procedure by December 201 1. 
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OIG Analysis: The department has made progress in proactive 
disclosure. As noted by the Chief FOIA Officer, the department 
has continued to improve proactive disclosure, and we determined 
that the progress is ongoing. We appreciate the past focus on this 
issue, which is central to an agency's disclosure program. The 
recommendation is resolved and open. 

Recommendation #2 : That the Chief FOIA Officer formalize the 
roles and responsibilities of the Public Liaison. 

Management Response: The department concurred with 
Recommendation #2. The Chief FOIA Officer and Deputy Chief 
FOIA Officer will work with the Public Liaison to further clarify 
the position's important role. The Chief FOIA Officer and Deputy 
Chief FOIA Officer, together with the Public Liaison and the 
component FOIA officers, will review the roles and 
responsibilities of the Public Liaison. The Privacy Office 
anticipates that it will accomplish this goal by September 30, 201 1. 

OIG Analysis: As with proactive disclosure, the department will 
be able to build on past progress and the positive relationships that 
the Public Liaison has created. The planned study of the position's 
role is an excellent opportunity to work with components and the 
public to make the department's use of the public liaison role a 
model for other federal agencies. The recommendation is resolved 
and open. 

Recommendation #3 : That the Chief FOIA Officer implement an 
internal review function to assess department-wide FOIA 
operations on a regular basis to maximize efficiencies and improve 
the administration of the department's FOIA operations. 

Management Response: The department concurred with 
Recommendation #3. The Chief FOIA Officer and Deputy Chief 
FOIA Officer intend to develop a collaborative internal review 
process over the next several months. 

OIG Analysis: We are pleased that the Privacy Office views an 
internal review program as a means to accomplish ongoing FOIA 
program improvement. Because of the department's positive 
reputation with components, we share the conclusion that the 
process will be collaborative and respectful of component equities. 
We anticipate that the Privacy Office will develop a successful 
review protocol. A focus on the quality of FOIA response letters is 
an obvious first area of review. This would allow the department 
to improve the effectiveness of its disclosure program while 
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gaining further public confidence. The recommendation is resolved 
and open. 

Recommendation #4 : That the Chief FOIA Officer report as 
necessary to the Secretary, based on 5 U.S.C. § 552(k)(3), to 
recommend improvements to the DHS FOIA enterprise. 

Management Response: The department concurred with 
Recommendation #4. The Chief FOIA Officer intends to develop 
recommendations to the Secretary on an as-needed basis. The 
specific timing of recommendations has not been determined. 

OIG Analysis: We are pleased that the department understands 
the utility of the (k)(3) process. The yet undetermined frequency 
of the recommendations is appropriate. We suggest that the Chief 
FOIA Officer develop a formalized policy on use of the authority, 
even if the timing of particular recommendations is not known. 
Provision of a new (k)(3) policy under the corrective action 
process would be sufficient to close the recommendation. The 
recommendation is resolved and open. 

Recommendation #5: That the Chief FOIA Officer use the 
authority at 5 U.S.C. § 552(k)(3) to recommend to the Secretary 
that the Secretary issue written guidance to the department on the 
President's reiteration that embarrassment, abstract fears, and the 
exposure of failure are not grounds to exempt information under 
FOIA. 

Management Response: The department concurred with 
Recommendation #5. The Privacy Office has issued 
memorandums on FOIA exemptions and the 2009 executive 
branch guidance. Further analysis of the need for additional 
support to DHS components will occur. The Privacy Office also 
plans a systematic review of Exemption 5 usage. 

OIG Analysis: During our inspection, we observed several 
positive efforts that the Privacy Office has made to inform 
components about FOIA policy. As with the meaningful work in 
other areas, we foresee potential for additional collaboration across 
DHS on the important realm of increasing transparency, as 
mandated by the President. The review of Exemption 5 usage 
should augment ongoing work on exemption policy development. 
Further details about new exemption policy guidance, especially 
the memorandum to the Secretary on the use of (b)(5), would help 
to close this recommendation. The recommendation is resolved 
and open. 
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Recommendation #6 : That the Chief FOIA Officer study and 
make recommendations to the Secretary regarding FOIA staffing 
levels. 

Management Response: The department concurred with 
Recommendation #6. The Privacy Office has analyzed FOIA 
staffing. Future work to evaluate staffing levels will build on 
previous efforts. New conclusions regarding staffing could then 
lead to recommendations to the Secretary on FOIA staffing levels 
across DHS. 

OIG Analysis: The Privacy Office has outlined a credible 
approach to this matter. We did not recommend new staff in any 
component because the Chief FOIA Officer can collaborate with 
FOIA officers across the department to determine the possible 
need for and frequency of staffing recommendations to the 
Secretary. The recommendation is resolved and open. 
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Appendix A 

Purpose, Scope, and Methodology 

We undertook this review based on our interest in the department's 
compliance with the Freedom of Information Act since the 2009 
executive branch guidance was issued. We reviewed presidential 
directives, information produced by DOJ's Office of Information 
Policy, legal cases, and DHS policies and data on FOIA 
implementation. The review focused on how the Privacy Office 
works on FOIA implementation with components, as well as how 
the significant request review process affected the DHS FOIA 
enterprise. We did not examine the FOIA appeals process. 

We did not examine component FOIA decisions, except for the 
redactions made to information that was provided to the 
Associated Press after a request for e-mail messages related to the 
review process. Under normal circumstances, our reports might 
include direct quotations from departmental records. We did not 
include all quotations that support our findings, however, because 
some of these statements have been redacted by the department in 
responding to a FOIA request that is currently pending under the 
DHS FOIA administrative appeals process. 

We conducted 21 interviews, which included discussions with staff 
from 1 1 DHS components that process FOIA requests, as well as 
with FOIA experts inside and outside of the federal government. 
We selected these interviewees to ensure a range of perspectives 
based on both the size of the component's FOIA caseload and 
subject matter expertise. The Office of Inspector General, like 
other DHS components, responds to FOIA requests. This report 
describes DHS FOIA policies and procedures with which we also 
comply. 

We conducted this performance inspection between July and 
September 2010 pursuant to the Inspector General Act of 1978, as 
amended, and according to the Quality Standards for Inspections 
issued by the Council of the Inspectors General on Integrity and 
Efficiency. 
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March 26, 2011 



Department of Homeland Security 
Washington. DC: 20528 

Homeland 
IP Security 



MEMORANDUM FOR: 



FROM: 



Carlton I. Mann 

Assistant Inspector General for Inspections 

Joseph B. Maher 
Deputy General Counsel 
Office of the General Counsel 



Mary Ellen Callahan 

Chief Freedom of Information Act Officer 



SUB JECT: Report Response 

The DHS Privacy Office Implementation of the 

Freedom of Information Ad 

OIG Project No. 10-151-ISP-PRIV 



The attached documents provide written comments from the Privacy Office to the Office of the 
Inspector General's Draft Report: The DHS Privacy Office Implementation of the Freedom of 
Information Act — For Official Use Only. The report identified measures that could be taken by 
the Privacy Office to enhance our office's overall effectiveness. 

Li the attached documents you will find the Privacy Office's specific responses to each 
recommendation and agreement or disagreement with each reported finding. 

We have reviewed the draft report and do not have any concerns about publicly releasing any 
information contained herein. 

Should you have any questions, please call Joe Maher at (202) 282-8137. or Maiy Ellen Callahan 
at (703) 235-0347. 

Attachments 



The DHS Privacy Office Implementation of the Freedom of Information Act 

Page 36 



Appendix B 

Management Comments to the Draft Report 



March 26, 2011 

Carlton I. Mann 

Assistant Inspector General for Inspections 
Office of Inspector General 
U.S. Department of Homeland Security 
Washington, DC 20528 

Re: Report Response 

The DHS Privacy Office Implementation of the 

Freedom of Information Act 

OIG Project No. 1 0-1 51-ISP-PRIV 

Dear Mr. Mann: 

The Department of Homeland Security's Privacy Office and the Office of the General Counsel 
appreciate the opportunity to review and respond to the Office of Inspector General (OIG) draft 
report The DHS Priracy Office Implementation of the Freedom of Information Act. 

The Privacy Office and the Office of the General Counsel are deeply committed to actively 
resolving the issues identified in the inspection and improving the Department's overall Freedom 
of Information Act (FOIA) operations. 

Context 

The Department agrees with the most important conclusions of the report by the Office of the 
Inspector General (OIG]: 1) there is no evidence that the review process involving the Office of 
the Secretary resulted in withholding any information that was otherwise recommended for 
release by career FOIA specialists: and 2) no FOIA requesters were disadvantaged because of 
their "political party or particular area of interest." While committed to resolving any issues, the 
Department is concerned about some aspects of the process OIG utilized in drafting this report 
and. as noted below, disagrees with several of the conclusions (although has concurred in the 
Recommend ations) . 

The Report rightfully notes the positive advancements made in proactive disclosure of material 
to the public under policies pursued by the Chief Freedom of Information Act Officer. 
The report provides a series of criticisms over incomplete implementation of the Department's 
position on pro-active disclosure without fully recognizing the systemic changes that must occur 
within the Department in order to significantly impact the number of FQIAs received. Given 
that approximately 70 percent of aLl FOIAs to the Department are Alien Files, the number of 
FOIAs the Department receives may never decrease significantly: nonetheless the breadth and 
scope of publicly available information has increased substantially during this Administration. 
The Privacy Office estimates that over 10.000 pages of federal records have been added to the 
FOIA Reading Room (also known as the FOIA Library) as part of the pro-active disclosure 
efforts over the past IS months. 

2 
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The report also does not properly define how a "significant FOIA"' is identified or the procedures 
for processing FOIAs generally in the Department. Beginning in 2005. the DHS FOIA office 
began identifying significant FOIA requests pursuant to objective standards 1 and providing 
notice of them to senior Department mana gement in a weekly report. In 2006. submission 
guidelines for what constituted a "significant FOIA" request were officially established by the 
DHS Privacy Office, and the current Administration has basically followed suit." Less than one 
half of one percent of DHS FOL4.S are designated by career FOIA professionals as "significant" 
FOIAs. 

The report further focuses on selected email communications without context, thus critiquing 
pre-decisional. deliberative communications even when the proposed action was not the final one 
taken. The Office of General Counsel and the Privacy Office are concerned that this selectivity 
of critiquing the communications, and the inaccurate conclusions therein, will have a chilling 
effect in intra -Department communications not just with regard to FOIA processing, but with 
regard to deliberative communications irn'f large. We discuss below our concerns with these 
aspects of the Report. 

Criticism of the Time Spent by the Office of the Secretary- in Reviewing Official Matters for 
Public Release Is Overstated by any Reasonable Measure. 

When compared with FOIA processing times across the entire Department — and even across the 
entire federal government — the time that the Office of the Secretary spent with FOIA matters 
was insignificant. The OIG Report fails to properly frame the context for its anecdotal evidence 
of review time when it declines to note that the Office of the Secretary reviewed less than half of 
1 percent of the FOIA responses processed in the Department. Even in this small percentage of 
matters reviewed by the Office of the Secretary, the OIG Report, at points, criticizes the Office 
of the Secretary for taking 1 to 4 days for review. 

This criticism is overstated by any reasonable measure when compared with FOIA processing 
times across the Department and at other federal agencies. In FY 2009. the Department's 
average processing time for a FOIA response was 240 days: in FY 2010. the average time 95 
days. The Department of Justice — which leads the federal government in FOIA policy — had 
average processing times of more than 1 13 days for complex FOIA responses and more than 26 
days for "simple" FOIA responses. (See U.S. Dept. of Justice Freedom of Information Act 
Annual Report FY 2010). Even the OIG's own FOIA responses at times reach beyond the 20 



1 All DHS Privacy Office memoranda on significant FOIA requests are available in the DHS FOIA 

Library at www.dlis.gov/foia. 

" "The 2006 Submission Guidelines are available at: 

lirtp:- ■'www.dlis.aov xlibrarv assets'foia'pnv foia .Ml.-me: :epo:t iujr.:ii;icr. i'V.i.:leli:ie; -''06jS04.pdf . 
The 2009 guidelines are available at: 

http^/www.dhs.cov/xiihfarv/assets/foia'priv cfoiao memo cabinet report foia guidelines 2009070 7.pd 
£ 
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day mark during the period covered by this report, with one OIG FOIA response taking more 
than 350 days to process. 

Given the OIG Report's focus on review by the Office of the Secretary in the context of the 
overall processing times, the only conclusion one can draw from the OIG Report is that the 
Inspector General believes that the Office of the Secretary should have no role in the review of 
any FOIA responses leaving the Department — regardless of how significant the official matters 
disclosed might be or how sensitive the homeland security information might be. 
This conclusion contradicts the legal framework of the Department and the conclusions 
articulated in the OIG report itself. As the report properly notes, the Secretary and her staff have 
clear statutoiy authority to ask questions of. review, and manage the operations of all parts of the 
Department, including the Privacy Office and its elements that handle the FOIA process, See 6 
U.S.C. § 102 ("The Secretary is the head of the Department and shall have direction, authority, 
and control over it"), The regulations that implement FOIA at DHS expressly contemplate a 
decision-making role for heads of components and thus are consistent on this point as well. -See 
6 C.F.R. § 5.4(b) ("The head of a component , , , is authorized to grant or deny any request for a 
record of that component''), Similarly, the Attorney General's March 2009 guidance 
memorandum states in relevant part that '"responsibility for effective FOIA administration 
belongs to all of us — it is not merely a task assigned to an agency's FOIA staff," Accordingly, 
it is not only legally permissible, but sound managerial practice, for the Office of the Secretary to 
be informed of and. in coordination with the Chief FOIA Officer, to play a role in overseeing the 
Department's FOIA processes. 

The OIG Report Inexplicably Criticizes Internal Deliberations over FOIA Responses that Did 
Not Prevent the Release of any Information. 

The OIG's unwarranted criticism of internal discussions involves two circumstances. One 
involves the deliberations over whether to release a draft mission statement of an intelligence 
threat division within the Department. The OIG Report criticizes this internal debate as 
somehow inappropriate because some officials questioned the proposal to release the draft 
mission statement. This criticism is unfounded because no law" or policy prohibits the 
Secretary's staff from questioning the release of a draft mission statement (which may not 
accurately reflect the actual mission) of an office handling sensitive, national security 
information. Rather than recognize these internal deliberations for what they were — legitimate 
back-and- forth discussions about disclosure of information — the OIG Report criticizes the mere 
"suggestion to reevaluate a FOIA release." 

Another example of unwarranted OIG criticism of internal discussions — discussions that did not 
prevent the release of any information — involved inquiries in which the Office of the Secretary 
asked about the identity of FOIA requesters. These inquiries were not made for the purpose of 
determining whether to disclose information: as the OIG Report notes, no rules or privacy law : s 
were violated in asking these questions. But rather than recognize as legitimate the puiposes that 
might underlie such requests (e.g., preparing to have constructive engagement with the media 
outlet requesting documents through FOIA). the OIG Report notes that these types of inquiries 
could delay the final issuance of FOIA responses. It is difficult to see. however, how requesting 

4 



The DHS Privacy Office Implementation of the Freedom of Information Act 

Page 39 



Appendix B 

Management Comments to the Draft Report 



the identity of a requester — or any other information that is readily available to the FOIA 
specialists handling the FOIA matters — would take any unreasonable amount of time. This 
criticism appears to simply be a reflection of the OIG's view that the Office of the Secretary 
should have no role in the review of any release of information under FOIA. 

Further, there is a larger concern with this portion of the Report than these discrete examples. 
The OIG's decision to criticize preliminary, internal discussions — rather than the ultimate 
decisions actually implemented — will certain send a chill in deliberations within the Department 
and cause some staff to refrain from asking questions or challenging prevailing views. Everyone 
is now alerted to the fact that to ask such questions or challenge such views now exposes 
employees to the possibility of public criticism by the Office of the Inspector General. 

Despite Not Interviewing Witnesses, and Contrary to its Recognition that No Information was 
Unlawfully Withheld when Releasing Documents to the Associated Press, the Report Criticizes 
the Department for not Going Above and Beyond what the Law Requires in Disclosing 
Deliberative Material. 

In a series of statements not pointing to specific documents, the Report states that "certain 
statements may have been withheld from the AP release merely to avoid embarrassment." 
Rather than consulting with the officials that made the decisions on what to produce and what 
information to redact, however, the OIG makes its criticisms without seeking to confirm the 
assumptions necessary to form the criticism (e.g., that certain redacted statements were "post- 
decisional" and that no other exemption applied). Before drawing conclusions, the OIG should 
confirm its assumptions. 

OIG did not interview any of the career attorneys in the Office of the General Counsel who made 
the substantive redactions to this release. Similarly. OIG did not request an explanation of the 
legal reasoning that underscored the redactions. Instead. OIG makes assumptions, absent any 
evidence, regarding these redactions. 

Part of the OIG's misunderstanding in this particular matter may stem from its failure to fully 
understand the purpose behind FOIA Exemption 5. In its Recommendation #5. the OIG 
recommends that the Secretary clarify that ""Exemption 5 is not designed to shield embarrassing 
or controversial words from public scrutiny.'' OIG Report at 29. But this is clearly inaccurate to 
the extent it refers to words spoken or written as part of the deliberative process within the 
government. One of the most important purposes of Exemption 5 is to preserve the robust 
debate and deliberations that shape and affect final policy and programmatic decisions by the 
government. See National Labor Relations Board v. Sears, Roebuck & Co., 421 U.S. 132, 150- 
51 (1975) ('"[HJuman experience teaches that those who expect public dissemination of their 
remarks may well temper candor with a concern for appearances ... to the detriment of the 
decisionmaking process. Manifestly, the ultimate purpose of this long -re cognized privilege is to 
prevent injury to the quality of agency decisions.") (citations omitted). Many times, arguments 
or statements made during the process may appear out of context after a full airing of the facts 
and views leading up to decisions. Those are exactly the words that need protection, so that 
officials do not fear the 20/20 vision of hindsight that might publicly expose what seemed like a 
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20 ad proposal or view early on in the decision process as a proposal or view that was not 
workable at all. That is different than deciding not to disclose remarks not aimed to affect any 
decisions of the government. The latter do not deserve any protection under FOIA. 

Reco in in end at ions for the Chief FOIA Officer 

Reco in in end at ion ffI: Develop additional internal policies regarding proactive disclosure to 
ensure consistency across components and quicker posting of information. 

The Privacy Office concurs with Recommendation # 1. DHS has made great strides to 
improve pro-active disclosure in the past 1 8 mouths. The Department has pro-actively 
disclosed over 10.000 pages in its FOIA Libraries, and new publications are being made 
almost weekly. With this experience and background, and based on input from 
component FOIA officers on how to fine-tune the system while being as efficient as 
possible, the Privacy Office is prepared to lead the development of additional policies, 
procedures and strategies to systematize the Department- wide approach to pro-active 
disclosure. The Privacy Office anticipates that it will accomplish this goal by December 
2011. 

Reco in in end a Hon HI: Formalize the roles and responsibilities of the Public Liaison. 

The Privacy- Office concurs with Recommendation s2. We appreciate the Inspector 
General's observations and compliments for the DHS Public Liaison, but recognize that 
we may have areas where it is necessary to clarify responsibilities. The Chief FOIA 
Officer and Deputy Chief FOIA Officer, together with the Public Liaison and the 
component FOIA Officers, will review the roles and responsibilities of the Public 
Liaison. The Privacy Office anticipates that it will accomplish this goal by September 
30.2011. 

Recommendation =3: Implement an internal review function to assess department- wide 
FOIA operations on a regular basis to maximize efficiencies and improve the 
administration of the Department's FOIA operations. 

The Privacy- Office concurs with Recommendation s3. The Chief FOIA Officer and 
Deputy Chief FOIA Officer will design a collaborative, effective internal review process. 
The Privacy Office anticipates that it will accomplish this goal by September 30, 201 1 . 

Recommendation U4: Report as necessary to the Secretary, based on 5 U.S.C. § 552(k)(3), 
to recommend improvements to the DHS FOL4. enterprise. 

The Privacy Office concurs with Recommendation #4. To the extent it is necessary to 
report to the Secretary on proposed improvements on the DHS FOIA enterprise, the Chief 
FOIA Officer will do so. However, given that this recommendation is only "as 
necessary," the Chief FOIA Officer declines to indicate any timing associated with this 
recommendation. 
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Recommendation U5: Vse the authority at 5 U.S.C. § 552(h)(3) to recommend to the 
Secretary that the Secretary issue written guidance to the department on the President's 
reiteration that embarrassment, abstract fears, and the exposure of failure are not grounds 
to exempt information under FOIA. 

The Privacy Office concurs with Recommendation #5. to the extent that embarrassment, 
abstract fears, and the exposure of failure should not be the sole basis for triggering an 
exemption under FOIA. As noted in the report, the Chief FOIA Officer has issued 
several memoranda detailing these aspects of FOIA. The Privacy Office can review 
current guidance and communications and see if they need to be bols tered by September 
30. 201 1 , The Chief FOIA Officer appreciates the report's highlighting the use of FOIA 
Exemption 5 in particular, and will review the use of this Exemption on a more 
systematic level than the OIG did in this report. 

Recommendation #6: Study and make recommendations to the Secretary regarding FOIA 
staffing levels. 

The Privacy Office concurs with Recommendation #6. The Privacy Office made some 
preliminary investigation into this issue in response to the then -White House Chief of 
Staff's March 16, 2010 Memorandum: the Privacy Office will update those figures and 
seek to reach conclusions on recommendations by July 31. 2011. 

Conclusion 

The Office of the General Counsel and the Privacy Office appreciate the Office of the 
Inspector General's attention on these issues, and values much of the input. However, the 
portions of the report that focus on the awareness review appear subjective given the repeated 
conclusions that nothing associated with the awareness review violated any laws, nor were 
FOIAs modified as a result of the awareness review. 

Addendum 

Technical Comments are attached as Addendum 1. 
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Abbreviated Descriptions 

See 5 U.S.C. § 552(b)(1) through (b)(9) for the full text of the exemptions and (c)(1) 
through (c)(3) for the full text of the exclusions. 



Exemption Number Matters That May Be Exempt From Disclosure Under FOIA 



1 Classified national defense and foreign relations information 

2 Internal agency personnel rules and practices 

3 Information that is prohibited from disclosure by another federal 
law 

4 Trade secrets and other confidential business information 

5 Inter-agency or intra-agency communications that are protected 
by legal privileges 

6 Information involving matters of personal privacy 

7 Certain information compiled for law enforcement purposes 

8 Information relating to the supervision of financial institutions 

9 Geological information on wells 



Exclusion Number Matters That May Be Excluded From the Reach of FOIA 



1 



Authorizes federal law enforcement agencies, under specific 
circumstances, to shield the very existence of records of ongoing 
investigations or proceedings by excluding them entirely from 
FOIA's reach 

Provides that "whenever informant records maintained by a 
criminal law enforcement agency under an informant's name or 
personal identifier are requested by a third party. . ., the agency 
may treat the records as not subject to the requirements of 
[FOIA] unless the informant's status as an informant has been 
officially confirmed" 

Pertains only to certain law enforcement records that are 
maintained by the Federal Bureau of Investigation 
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Figure 1. January 21, 2009, President's Memorandum on FOIA 
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Memorandum of January 21, 2009 



The President 



Freedom of Information Act 



Memorandum for the Heads of Executive Departments and Agencies 

A democracy requires accountability, and accountability requires trans- 
parency, As Justice Louis Brandeis wrote, "sunlight is said to be the best 
of disinfectants." In our democracy, the Freedom of Information Act (FOIA), 
which encourages accountability through transparency, is the most prominent 
expression of a profound national commitment to ensuring an open Govern- 
ment. At the heart of that commitment is the idea that accountability is 
in the interest of the Government and the citizenry alike. 

The Freedom of Information Act should be administered with a clear pre- 
sumption: In the face of doubt, openness prevails. The Government should 
not keep information confidential merely because public officials might be 
embarrassed by disclosure, because errors and failures might be revealed, 
or because of speculative or abstract fears. Nondisclosure should never be 
based on an effort to protect the personal interests of Government officials 
at the expense of those they are supposed to serve. In responding to requests 
under the FOIA, executive branch agencies [agencies) should a"ct promptly 
and in a spirit of cooperation, recognizing that such agencies are servants 
of the public. 

All agencies should adopt a presumption in favor of disclosure, in order 
to renew their commitment to the principles embodied in FOIA, and to 
usher in a new era of open Government. The presumption of disclosure 
should be applied to all decisions involving FOIA. 

The presumption of disclosure also means that agencies should take affirma- 
tive steps to make information public. They should not wait for specific 
requests from the public, All agencies should use modern technology to 
inform citizens about what is known and done by their Government. Disclo- 
sure should be timely. 

I direct the Attorney General to issue new guidelines governing the FOIA 
to the heads of executive departments and agencies, reaffirming the commit- 
ment to accountability and transparency, and to publish such guidelines 
in the Federal Register. In doing so. the Attorney General should review 
FOIA reports produced by the agencies under Executive Order 13392 of 
December 14, 20OE. I also direct the Director of the Office of Management 
and Budget to update guidance to the agencies to increase and improve 
information dissemination to the public, including through the use of new 
technologies, and to publish such guidance in the Federal Register. 

This memorandum does not create any right or benefit, substantive or proce- 
dural, enforceable at law or In equity by any party against the United 
States, its departments, agencies, or entities, its officers, employees, or agents, 
or any other person. 



The DHS Privacy Office f mplementation of the Freedom of Information Act 

Page 44 



Appendix D 

2009 Executive Branch Guidance 



4684 
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15 /Monday. January 26. 2009 /Presidential Documents 



The Director of the Office of Management and Budget is hereby authorized 
and directed to publish this memorandum in the Federal Register. 




THE WHITE HOUSE, 
Washington . January 21. 2009 



[FR Doc. E9-1773 

Filed l-as-09: am] 

Ei]]ing code 31JO-01-P 



[http ://edocket.acces s .gpo .gov/2009/pdf/E9- 1 773 .pdf] 
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Figure 2. March 19, 2009, Attorney General's Memorandum on FOIA 



MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES 



SUBJECT: The Freedom oflnformation Act (FOIA) 

The Freedom oflnformation Act (FOIA), 5 U.S.C. § 552, reflects our nation's 
fundamental commitment to open government. This memorandum is meant to underscore that 
commitment and to ensure that it is realized in practice. 

A Presumption of Openness 

As President Obama instructed in his January 21 FOIA Memorandum. "The Freedom of 
Information Act should be administered with a clear presumption: In the face of doubt, openness 
prevails." This presumption has two important implications. 

First, an agency should not withhold information simply because it may do so legally. 
I strongly encourage agencies to make discretionary disclosures of information. An agency 
should not withhold records merely because it can demonstrate, as a technical matter, that the 
records fall within the scope of a FOIA exemption. 

Second, whenever an agency determines that it cannot make full disclosure of a requested 
record, it must consider whether it can make partial disclosure. Agencies should always be 
mindful that the FOIA requires them to take reasonable steps to segregate and release nonexempt 
information. Even if some parts of a record must be withheld, other parts either may not be 
covered by a statutory exemption, or may be covered only in a technical sense unrelated to the 
actual impact of disclosure. 

At the same time, the disclosure obligation under the FOIA is not absolute. The Act 
provides exemptions to protect, for example, national security, personal privacy, privileged 
records, and law enforcement interests. But as the President stated in his memorandum. "The 
Government should not keep information confidential merely because public officials might be 
embarrassed by disclosure, because errors and failures might be revealed, or because of 
speculative or abstract fears." 

Pursuant to the President's directive that I issue new FOIA guidelines, I hereby rescind 
the Attorney General's FOIA Memorandum of October 12, 2001, which slated that the 
Department of Justice would defend decisions to withhold records "unless they lack a sound 




(Office of tfje SUtomep general 



8?asrjmatcri, 13. €. 2C>530 



March 19, 2009 
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Memorandum for Heads of Executive Departments and Agencies Page 2 

Subject: The Freedom of Information Act 

legal basis or present an unwarranted risk of adverse impact on the ability of other agencies to 
protect other important records," 

Instead, the Department of Justice will defend a denial of a FOIA request only if (1) the 
agency reasonably foresees that disclosure would harm an interest protected by one of the 
statutory exemptions, or (2) disclosure is prohibited by law. With regard to litigation pending on 
the date of the issuance of this memorandum, this guidance should be taken into account and 
applied if practicable when, in the judgment of the Department of Justice lawyers handling the 
matter and the relevant agency defendants, there is a substantial likelihood that application of the 
guidance would result in a material disclosure of additional information. 

FOIA Is Evenone s Responsibility 

Application of the proper disclosure standard is only one part of ensuring transparency. 
Open government requires not just a presumption of disclosure but also an effective system for 
responding to FOIA requests. Each agency must be fully accountable for its administration of the 
FOIA. 

I would like to emphasize that responsibility for effective FOIA administration belongs to 
all of us — it is not merely a task assigned to an agency's FOIA staff. We all must do our part to 
ensure open government. In recent reports to the Attorney General, agencies have noted that 
competing agency priorities and insufficient technological support have hindered their ability to 
implement fully the FOIA Improvement Plans that they prepared pursuant to Executive Order 
13392 of December 14, 2005. To improve FOIA performance, agencies must address the key 
roles played by a broad spectrum of agency personnel who w ork with agency FOIA professionals 
in responding to requests. 

Improving FOIA performance requires the active participation of agency Chief FOIA 
Officers. Each agency is required by law to designate a senior official at the Assistant Secretary 
lev el or its equivalent who has direct responsibility for ensuring that the agency efficiently and 
appropriate!) complies with the FOIA. That official must recommend adjustments to agency 
practices, personnel, and funding as may be necessary. 

Equally important, of course, are the FOIA professionals in the agency who directly 
interact with FOIA requesters and are responsible for the day-to-day implementation of the Act. 
I ask that you transmit this memorandum to all such personnel. Those professionals deserve the 
full support of the agency's Chief FOIA Officer to ensure that they have the tools they need to 
respond promptly and efficiently to FOIA requests. FOLA professionals should be mindful of 
their obligation to work "in a spirit of cooperation"" with FOIA requesters, as President Obama 
has directed. Unnecessary bureaucratic hurdles have no place in the "new era of open 
Government" that the President has proclaimed. 
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Memorandum for Heads of Executive Departments and Agencies Page 3 

Subject: The Freedom of Information Act 

Working Proaetivelv and Promptly 

Open government requires agencies to work proactively and respond to requests 
promptly. The President's memorandum instructs agencies to "use modem technology to inform 
citizens what is known and done by their Government." Accordingly, agencies should readily 
and systematically post information online in advance of any public request. Providing more 
information online reduces the need for individualized requests and may help reduce existing 
backlogs. When information not previously disclosed is requested, agencies should make it a 
priority to respond in a timely manner. Timely disclosure of information is an essential 
component of transparency. Long delays should not be viewed as an inevitable and 
insurmountable consequence of high demand. 

In that regard, I would like to remind you of a new requirement that went into effect on 
December 31. 2008, pursuant to Section 7 of the OPEN Government Act of 2007, Pub. L. 
No, 1 10-175. For all requests filed on or after that date, agencies must assign an individualized 
tracking number to requests that will take longer than ten days to process, and provide that 
tracking number to the requester. In addition, agencies must establish a telephone line or Internet 
service that requesters can use to inquire about the status of their requests using the request's 
assigned tracking number, including the date on which the agency received the request and an 
estimated date on which the agency will complete action on the request. Further information on 
these requirements is available on the Department of Justice's website at 
www.usdoi.ao\'.'oip/foiaposty2008foiapost30.htm . 

Agency Chief FOIA Officers should review all aspects of their agencies' FOIA 
administration, with particular focus on the concerns highlighted in this memorandum, and report 
to the Department of Justice each year on the steps that have been taken to improve FOIA 
operations and facilitate information disclosure at their agencies. The Department of Justice's 
Office of Information Policy (OIP) will offer specific guidance on the content and timing of such 
reports. 

1 encourage agencies to take advantage of Department of Justice FOIA resources. OIP 
will provide training and additional guidance on implementing these guidelines. In addition, 
agencies should feel free to consult with OIP when making difficult FOIA decisions, With 
regard to specific FOIA litigation, agencies should consult with the relevant Civil Division, Tax 
Division, or U.S. Attorney's Office lawyer assigned to the case. 

This memorandum is not intended to, and does not, create any right or benefit, 
substantive or procedural, enforceable at law or equity by any party against the United States, its 
departments, agencies, instrumentalities or entities, its officers, employees, agents, or any other 
person, 

[http://www.justice.gov/ag/foia-memo-march2009.pdf] 
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Chief of Staff 

General Counsel 
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Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief FOIA Officer 

Office of Management and Budget 

Chief, Homeland Security Branch 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



